Posted
by
timothy
on Thursday August 14, 2014 @08:32AM
from the widespread-and-easy-are-tightly-linked dept.

An anonymous reader writes Ryan Lackey of CloudFlare and Marc Rogers of Lookout revealed a new OPSEC device at Def Con called PORTAL (Personal Onion Router to Assure Liberty). It "provides always-on Tor routing, as well as 'pluggable' transport for Tor that can hide the service's traffic signature from some deep packet inspection systems." In essence, PORTAL is a travel router that the user simply plugs into their existing device for more than basic Tor protection (counterpoint to PogoPlug Safeplug and Onion Pi). On the down side, you have to download PORTAL from Github and flash it "onto a TP-Link compatible packet router." The guys behind the device acknowledge that not many people may want to (or even know how to) do that, so they're asking everyone to standby because a solution is pending.The project's GitHub page has a README file that lists compatible models, with some caveats: "It is highly recommended to use a modified router. The modified MR11U and WR703N provide a better experience than the stock routers due to the additional RAM. The severe space constraints of the stock router make them very challenging to work with. Due to the lack of usable space, it is necessary to use an external disk to store the Tor packages. The stock router has only a single USB port, and the best option is to use a microSD in a 3G modem." (Note: Lackey is no stranger to helping people secure internet privacy.)

Why TP-Link? There are lots of models of routers that are that are readily available, have enough onboard flash and ram, and support DD-WRT (some even come with it out of the box). Why start with two models from TP-Link which do not meet the minimum requirements without physical modification?!?

Thank you. That makes a lot more sense.EG. The TP-Link routers mentioned are small travel routers (good for this purpose), low power (even usb or battery powered), and have onboard ethernet, 802.11n, usb, easily accessible serial consoles, and good openwrt support.

So yes, a travel router with a bit more ram and/or flash + openwrt support would be nice.

That said, if they're trying to market to the public, then it might be easier to go with a larger model that has the necessary ram/flash than one that is a de

How much you wanna bet "magical" packets delivered to it's ethernet port from the WAN could be interpreted specially to allow the machine to reply with packets of it's internal memory (passwords, ssh keys, tor keys, etc).

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any OS running on top of that router.
Buy a non-router based piece of hardware and use that. You seriously cannot trust what you'll find inside a Linksys router people. The bug is below the software level so your fancy firmware does *nothing*.

There certainly are countermeasures you can (and should) take, but generally, applying technical solutions to political and social problems doesn't work long-term.

There's no reason the populace cannot both a) harden against as many security vulnerabilities as you reasonably can, and b) take back the political power from the ruling elite and institute oversight against massive surveillance and other governmental abuses, including severe criminal penalties against officials supporting them.

Yeah; what I can't figure out is what happened to criminal cases being thrown against public servants proven to be intentionally serving someone other than the public. It's even beyond cronyism, and it seems to have hit all levels of government to one degree or another (excluding the alderman recently arrested for documenting police brutality).

No just stop it right now, stop with this craziness. Exploits of *hardware* over the network, or building in some monitoring directly in the hardware are extremely rare, not to mention difficult (read expensive) to do. Unless you are a high value target, you needn't worry about such theories over possible attack vectors. The hardware is going to be cheap but it's not going to be compromising your data.

Manufacturers of Consumer level devices are concerned about one thing, making a profit. That means they

The poster was saying he would NOT run a Thor exit node, and his reasons where perfectly valid.

I too do not want to try and answer questions about why my IP address was being used to distribute say kiddie porn. Saying, well, I run a Thor exit node doesn't matter to the cops, it was your IP address so they assume it came from your household. Same with the MPAA and somebody seeding a torrent of a DVD image. The courts are NOT going to care about the exit node, you agreed to allowing the traffic by setting

"It is highly recommended to use a router configuration we're not going to document or even provide you a link to".

The document implies that at least one modification is a flash and RAM upgrade - but they don't even provide links to details of this modification and/or whether any other techniques are needed (how do you populate the bootloader in the new flash? Or does the SoC itself have a built-in recovery mode?)

This sounds like a bunch of bullshit by obfuscation. It doesn't matter the expected level of the end user. If they need documentation they need it. There is no excuse for shitty documentation even if this isn't the only project plagued with it. Telling people to comb the Internet for how to use a non-trivial piece of software is the surest way to see it implemented wrong in the largest number of ways. And this applies really, to anything requiring instructions. In this case it is very important to the user

Getting lots of people running Tor even if they don't need to, even if the implementation may not be the "best" possible, for various definitions of best, is that it dilutes the number of users using Tor for "bad" things.

I don't know what the percent of users of Tor are using it for the standard list of things the government needs to save us from, but you know that eventually the argument will get made, which owing to the nature of Tor will be almost impossible to disprove, that basically everyone using it

Yes with most projects just follow the years of funding. Good enough tech to fund a distant color revolution https://en.wikipedia.org/wiki/... [wikipedia.org] but the entry end end points are still gov friendly.

Speaking as an attendee, I thought the neatest feature covered in the presentation itself that I haven't seen many articles covering this touch on was a rather ambitious development goal Marc Rogers spoke to for about the last 15 minutes of their talk at Defcon. In addition to all of the security features the firmware is capable of doing, as well as having the ability to enable/disable specific features based on your needs and limitations of whatever hardware you flash it onto, the team's long-term goal is